PkgSeer

Vulnerability GHSA-fccv-jmmp-qg76

High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
2 years ago
November 28, 2023 at 06:30 PM UTC
Apache Tomcat Improper Input Validation vulnerability
8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 11.0.0
8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 11.0.0

Summary

Apache Tomcat Improper Input Validation vulnerability

Details

Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Critical
1 month ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.10 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 9.0.100 and 9.0.102 and 9.0.120 and 10.1.4 and 11.0.18 GHSA-9xv2-5v5q-p794
7.0.30 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.10 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 9.0.100 and 9.0.102 and 9.0.120 and 10.1.4 and 11.0.18 GHSA-9xv2-5v5q-p794
Critical
1 month ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.10 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 9.0.100 and 9.0.102 and 9.0.120 and 10.1.4 and 11.0.18 GHSA-9xv2-5v5q-p794
7.0.30 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.10 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.48 and 9.0.50 and 9.0.100 and 9.0.102 and 9.0.120 and 10.1.4 and 11.0.18 GHSA-9xv2-5v5q-p794
Critical
1 month ago
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-gcx9-497g-6cp6
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-gcx9-497g-6cp6
Critical
1 month ago
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-gcx9-497g-6cp6
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-gcx9-497g-6cp6
Critical
1 month ago
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-h3x4-894j-xpx5
7.0.0 and 7.0.2 and 7.0.8 and 7.0.11 - 7.0.12 and 7.0.14 and 7.0.16 and 7.0.37 and 7.0.47 and 7.0.50 and 7.0.59 and 7.0.72 - 7.0.73 and 7.0.81 - 7.0.82 and 7.0.88 and 7.0.96 and 7.0.99 - 7.0.100 and 8.5.0 and 8.5.8 - 8.5.9 and 8.5.23 - 8.5.24 and 9.0.1 - 9.0.2 and 9.0.7 - 9.0.8 and 9.0.16 - 9.0.17 and 9.0.24 and 9.0.26 - 9.0.27 and 9.0.40 - 9.0.41 and 9.0.48 and 9.0.50 and 9.0.78 - 9.0.79 and 9.0.102 and 11.0.18 GHSA-h3x4-894j-xpx5
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
2 years ago
November 28, 2023 at 06:30 PM UTC
Fixed (11.0.0-M11)
Unknown
Unknown
Fixed (10.1.16)
Unknown
Unknown
Fixed (9.0.83)
Unknown
Unknown
Fixed (8.5.96)
Unknown
Unknown
Fixed (11.0.0-M11)
Unknown
Unknown
Fixed (10.1.16)
Unknown
Unknown
Fixed (9.0.83)
Unknown
Unknown
Fixed (8.5.96)
Unknown
Unknown
Fixed (11.0.0-M11)
Unknown
Unknown
Last Modified
3 hours ago
October 02, 2026 at 08:30 PM UTC